UBUNTU Basics: Creating user authentication

User authentication in *nix based system involves creating username and password for users to provide them access to directories or files. There are two steps involved in providing user authentication.
1) Creating user name and password file
2) Password protecting directories or files

As the first step, we will create a file called “.mypass” for storing user names and passwords by using the *nix

htpasswd command. Store this file in server root (for e.g. /usrl/local/) and not in web based access folders where public access is given.

We will create a directory called “secured” under /usr/local.

user@myhost:~# cd /usr/local
user@myhost:~# mkdir secured
user@myhost:~# htpasswd -c /usr/local/secured/.mypass username

On running the last command, the user will be prompted to type password for the user “username”. The -c argument is used to create the file “.mypass”. To append to the user list you can type the same command above without -c option. In .mypass file, you will have a combination of user names and encrypted password delimited by “:”.

Ensure that you give read, execute permission settings for the folder “secured” and the file “.mypass”

user@myhost:~# chmod 755 secured
user@myhost:~# chmod 755 secured/.mypass

In order to make .htaccess files work, we need to edit the file /etc/apache2/sites-available/default and go to the line which states “AllowOverride None”. This needs to get changed to “AllowOverride All” to facilitate .htaccess in each folder to override settings given by other directives.

<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
# Uncomment this directive is you want to see apache2’s
# default start page (in /apache2-default) when you go to /
#RedirectMatch ^/$ /apache2-default/
</Directory>

Once the above changes are done, we need to reload the Apache configuring setting files by issing the following command

user@myhost:~# sudo /etc/init.d/apache2 reload

Next section will cover the .htaccess setting for password protecting files or directories